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Does the updated code adequately explain and advise on the new aspects of data protection 
legislation which are relevant to data sharing? 

Yes 
X| No 


If not, please specify where improvements could be made. 

The section on law enforcement processing p62-68 offers very little help to police forces 
seeking to understand how to meet the legislation when sharing data (collected under part 
3) with non-competent authorities for GDPR purposes. 


Does the draft code cover the right issues about data sharing? 


Yes 
X No 


If no, what other issues would you like to be covered in it? 
The examples are dominated by those relating to the NHS. Please could more examples from 
other public bodies be included. 


Does the draft code contain the right level of detail? 


Yes 
X| No 


If no, in what areas should there be more detail within the draft code? 

e More explanation on the Human Rights Act in respect of Article 8(2) to explain 
why, when necessary, there are exceptions to the right to respect private and 
family life. 

e it would be helpful for the ICO to suggest (or give an example) how to coherently 
set out the legal basis of an ISA which has multiple partners that are a mixture of 
competent authorities, public authorities and third parties/charities. 


Has the draft code sufficiently addressed new areas or developments in data protection that 
are having an impact on your organisation’s data sharing practices? 

Yes 
X| No 


If no, please specify what areas are not being addressed, or not being addressed in enough 
detail. 

More detail would be helpful regarding the sharing by a competent authority processing 
under Part 3 with organisations who are processing under Part 2. 


Does the draft code provide enough clarity on good practice in data sharing? 


Yes 
X| No 


If no, please indicate the section(s) of the draft code which could be improved, and what can 
be done to make the section(s) clearer. 

The old code had a small example after almost every paragraph. This provided context and 
was helpful when dealing with complex disclosure requests. 
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Does the draft code strike the right balance between recognising the benefits of sharing data 
and the need to protect it? 


X| Yes 
No 
If no, in what way does the draft code fail to strike this balance? 
Does the draft code cover case studies or data sharing scenarios relevant to your 
organisation? 
Yes 


No - The police sharing scenarios are largely focussed on other organisations sharing 
their data with police, not the other way round. The draft code of practice did not cover 
less standard sharing such as requests from solicitors or providing personal data to 
private organisations such as Business Crime Reduction Partnerships, Insurance 
companies etc. Also some of the examples point out what went wrong but do not 
provide direction as to what the correct response should have been. 


Please provide any further comments or suggestions you may have about the draft code. 
There is a heavy reliance on hyperlinks to external resources, is it realistic that all those 
links will remain valid and working throughout the CoP life? 
To what extent do you agree that the draft code is clear and easy to understand? 
Strongly agree 
X| Agree 
Neither agree nor disagree 
Disagree 


Strongly disagree 


